CLI shards refresh unrelated apt repositories before installing Pi search tools

## Investigation Summary

- `.github/actions/ci-cli-coverage-shard/action.yaml` runs an unscoped `sudo apt-get update -qq` in every CLI shard before installing `fd-find` and `ripgrep`.
- GitHub-hosted Ubuntu runners can contain unrelated third-party apt sources. A Google Chrome repository metadata mismatch caused all 12 shards to fail before dependencies or tests ran.
- The two Pi search tools are required; Chrome and other ambient repositories are not.
- Exact package and executable version checks already provide the required fail-closed tool contract.
- No existing open issue describes this failure.

## Description

CLI coverage needs pinned `fd` and `rg` binaries for Pi-dependent tests. The shared shard action currently refreshes every apt source inherited from the hosted runner. An unrelated repository can therefore block all CLI tests even though NemoClaw does not consume packages from that repository.

Expected behavior: installing the pinned Pi search tools contacts only the accepted Ubuntu package source and retains exact package and executable verification. Unrelated runner repositories must not affect the shard.

## Reproduction Steps

1. Run a NemoClaw PR CI workflow on `ubuntu-24.04` while any unrelated configured apt source has inconsistent metadata.
2. Observe the `Install pinned Pi search tools` step in each `cli-test-shards` job.
3. `sudo apt-get update -qq` refreshes the unrelated source and exits before `fd-find` or `ripgrep` installation.
4. All CLI shards fail before running tests.

Representative evidence: https://github.com/NVIDIA/NemoClaw/actions/runs/34382965584/job/102573878688

## Environment

- GitHub-hosted `ubuntu-24.04`
- Runner image observed in the failing jobs: `20260831.293.1`
- Node.js: 22.23.2
- NemoClaw base commit: `7e4bdf27f17bd760a02e36467d7ea79a9ae5a37e`
- Owning action: `.github/actions/ci-cli-coverage-shard/action.yaml`

## Debug Output

Not applicable. This failure occurs in GitHub Actions before NemoClaw tests execute.

## Proposed Acceptance Criteria

- Refresh only the Ubuntu 24.04 package source required for `fd-find=9.0.0-1` and `ripgrep=14.1.0-1`.
- Do not refresh or modify unrelated third-party apt repositories.
- Preserve exact installed-package and executable-version verification.
- Add a workflow contract test that rejects an unscoped `apt-get update` in the CLI shard action.
- Prove the action fails closed when the Ubuntu source or pinned package version is unavailable.

## Security and Reliability Impact

This reduces the CI network trust boundary. The shard should obtain two pinned packages from Ubuntu rather than trusting every repository configured in the mutable hosted-runner image.

## Logs

```shell
E: Failed to fetch https://dl.google.com/linux/chrome-stable/deb/dists/stable/main/binary-amd64/Packages.gz Hash Sum mismatch
E: Some index files failed to download.
```

## Checklist

- [x] I confirmed this bug is reproducible
- [x] I searched existing issues and this is not a duplicate

Start with .github/actions/ci-cli-coverage-shard/action.yaml and inspect the Install pinned Pi search tools step, then review how the CLI shard workflow and its contract tests are organized. Run the CLI workflow or relevant checks against the documented failure case. Done means only the accepted Ubuntu source is refreshed, exact fd-find and ripgrep checks remain, unrelated repositories cannot block the shard, and the contract tests cover unavailable sources or versions.

Written by the indexing model from the issue text.